@backstage/plugin-scaffolder-common
3
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
patrikofrebenmarcuseide
Keywords
scaffolder
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:uri-template | AI (dependencies): uri-template is a legitimate, established URI templating library; its use in a Backstage scaffolder package is expected and benign. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): zen-observable is a well-known observable library used across the JS ecosystem; no security concern for this package. | ai | |
| dependencies | unvetted-dep:@backstage/types | AI (dependencies): Part of the official Backstage monorepo; a first-party dependency with no security concern. | ai | |
| dependencies | unvetted-dep:@backstage/plugin-permission-common | AI (dependencies): Part of the official Backstage monorepo; a first-party dependency with no security concern. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): @types/json-schema is a TypeScript type package commonly declared as a runtime dep to expose JSON Schema types in the public API; stable false positive for this package. | ai |